Identifying High Cardinality Internet Hosts

—The Internet host cardinality, defined as the number of distinct peers that an Internet host communicates with, is an important metric for profiling Internet hosts. Some example applications include behavior based network intrusion detection, p2p hosts identification, and server identification. However, due to the tremendous number of hosts in the Internet and high speed links, tracking the exact cardinality of each host is not feasible due to the limited memory and computation resource. Existing approaches on host cardinality counting have primarily focused on hosts of extremely high cardinalities. These methods do not work well with hosts of moderately large cardinalities that are needed for certain host behavior profiling such as detection of p2p hosts or port scanners. In this paper, we propose an online sampling approach for identifying hosts whose cardinality exceeds some moderate prescribed threshold, e.g. 50, or within specific ranges. The main advantage of our approac...

• Type: Conference
• Year: 2009
• Where: INFOCOM
• Authors: Jing Cao, Yu Jin, Aiyou Chen, Tian Bu, Zhi-Li Zhang
• Keywords: Cardinality, Communications, Host Cardinality, INFOCOM 2009, Low Cardinality Hosts